feat: Sigma rules pt.3

tests/sigma_rules/collection/collection.yaml

@@ -0,0 +1,30 @@
+rules:
+  - title: Disk Space Critical
+    id: c3d4e5f6-a7b8-9012-cdef-345678901234
+    status: stable
+    description: Detects critically low disk space
+    logsource:
+      category: system
+      product: linux
+    detection:
+      selection:
+        metric: disk_usage_percent
+      filter:
+        disk_usage_percent|gte: 95
+      condition: selection and filter
+    level: critical
+
+  - title: Memory Exhaustion Warning
+    id: d4e5f6a7-b8c9-0123-defa-456789012345
+    status: experimental
+    description: Detects when system memory is nearly exhausted
+    logsource:
+      category: system
+      product: linux
+    detection:
+      selection:
+        metric: memory_percent
+      filter:
+        memory_percent|gte: 90
+      condition: selection and filter
+    level: high

tests/sigma_rules/single/high_cpu_process.yaml

@@ -0,0 +1,14 @@
+title: Abnormally High CPU Usage by Process
+id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
+status: stable
+description: Detects when a single process uses excessive CPU
+logsource:
+  category: process_monitoring
+  product: linux
+detection:
+  selection:
+    metric: cpu_percent
+  filter:
+    cpu_percent|gte: 95
+  condition: selection and filter
+level: high

tests/sigma_rules/single/ssh_failed_login.yaml

@@ -0,0 +1,14 @@
+title: Failed SSH Login Attempt
+id: 5f3a4e20-1b2c-4d5e-9f8a-7b6c3d4e5f6a
+status: experimental
+description: Detects failed SSH login attempts
+logsource:
+  category: authentication
+  product: linux
+  service: sshd
+detection:
+  selection:
+    event_type: authentication_failure
+    service: sshd
+  condition: selection
+level: medium

tests/sigma_rules/single/unauthorized_api_access.yaml

@@ -0,0 +1,19 @@
+title: Unauthorized API Access Attempt
+id: b2c3d4e5-f6a7-8901-bcde-f23456789012
+status: test
+description: Detects HTTP 401/403 responses from API endpoints
+logsource:
+  category: webserver
+  product: generic
+  service: api_gateway
+detection:
+  selection:
+    http_status:
+      - 401
+      - 403
+  filter:
+    request_path|startswith: /api/
+  condition: selection and filter
+level: medium
+tags:
+  - team.security

tests/test_rules_promql.py

@@ -847,9 +847,7 @@ def test_multi_suffix_glob_logs_ignored_files(caplog):
 
     suffixes = [".rules", ".yml", ".yaml", ".rule"]
     with caplog.at_level("INFO", logger="cosl.rules"):
-        matched = _multi_suffix_glob(
-            Path(sandbox.getsyspath("/")), suffixes, recursive=False
-        )
+        matched = _multi_suffix_glob(Path(sandbox.getsyspath("/")), suffixes, recursive=False)
 
     matched_names = {p.name for p in matched}
     assert matched_names == {"valid.rules", "also_valid.yml"}